CVE-2025-68973
High · 7.0CVSS
7.0
EPSS
0.2%
Published
Dec 28, 2025
CISA due date
—
The record
In GnuPG before 2.4.9, armor_filter in g10/armor.c has two increments of an index variable where one is intended, leading to an out-of-bounds write for crafted input. (For ExtendedLTS, 2.2.51 and later are fixed versions.)
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | gnupg2 | 0 | 2.4.5-3.el10_1 |
| AlmaLinux:10 | gnupg2-smime | 0 | 2.4.5-3.el10_1 |
| AlmaLinux:8 | gnupg2 | 0 | 2.2.20-4.el8_10 |
| AlmaLinux:8 | gnupg2-smime | 0 | 2.2.20-4.el8_10 |
| AlmaLinux:9 | gnupg2 | 0 | 2.3.3-5.el9_7 |
| AlmaLinux:9 | gnupg2-smime | 0 | 2.3.3-5.el9_7 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | gpg2 | 0 | 2.4.4-150600.3.12.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | gpg2 | 0 | 2.4.4-150600.3.12.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | gpg2 | 0 | 2.4.4-150600.3.12.1 |
| openSUSE:Leap 15.6 | gpg2 | 0 | 2.4.4-150600.3.12.1 |
| openSUSE:Leap 16.0 | gpg2 | 0 | 2.5.5-160000.3.1 |
| openSUSE:Tumbleweed | gpg2 | 0 | 2.5.16-1.1 |
Related vulnerabilities
- CVE-2019-13050 Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network… Also affects gnupg2
- CVE-2026-24882 In GnuPG before 2.5.17, a stack-based buffer overflow exists in tpm2daemon during… Also affects gpg2
- CVE-2026-24883 In GnuPG before 2.5.17, a long signature packet length causes parse_signature to return… Also affects gpg2
- CVE-2026-24881 In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an… Also affects gpg2
- CVE-2014-4617 The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before… Also affects gpg2